Instructure reported that unauthorized actors accessed Canvas systems on April 25, 2026, and that the company detected the intrusion four days later. On May 1 and 2, Instructure said names, email addresses, student identification numbers, and user messages had been accessed for ransom, while stating there was no evidence that passwords, birth dates, government identifiers, or financial information were involved. The company revoked access, hired outside forensic specialists, and attributed a later exploit to an issue involving Free-For-Teacher accounts.
The incident escalated on May 7, when the ShinyHunters criminal group defaced the Canvas login page with a ransom demand, disrupting institutions during final examinations. ShinyHunters claimed to possess 3.65 terabytes of data belonging to about 275 million users and nearly 9,000 institutions, but the source says those figures and the full scope were not independently verified. Instructure apologized on May 11, claimed an agreement had been reached and the compromised data destroyed, and did not disclose its terms; reports of a $10 million payment remained unconfirmed. A proposed class action was filed in the Southern District of California on May 13, while the U.S. House Homeland Security Committee requested a briefing from CEO Steve Daly by May 21 on the intrusions, data volume, containment, notification, and coordination with federal authorities.
